Htet Oo Wai Yan sc3p73r-it

Setup Kubernetes Cluster On-Premise using kubeadm

Why would you do this?

You own your bare metal infrastructure.
You want to take advantage of Kubernetes.
You do not wish to migrate your application to the cloud

Why it will not always suit your needs?

Ubuntu-Server-Hardening

1. Secure Shared Memory

What is shared memory?

Shared memory is an efficient means of passing data between programs. Because two or more processes can use the same memory space, it has been discovered that, since shared memory is, by default, mounted as read/write, the /run/shm space can be easily exploited. That translates to a weakened state of security.

If you’re unaware, shared memory can be used in an attack against a running service. Because of this, you’ll want to secure that portion of system memory.

	#!/bin/bash

	kubedl() {
	echo "Downloading ${2} v${1}..."
	curl -LO --progress-bar https://dl.k8s.io/v${1}/bin/linux/amd64/${2}
	check ${1} ${2}
	mkdir -p "v${1}"
	mv ${2} "v${1}/"
	}

	#!/bin/bash

	if [ -z "${1}" ]; then
	echo "Please provide a username and the namespace or the username only for the cluster role..."
	echo "Usage: ${0} USERNAME [NAMESPACE] [ROLE]"
	echo "Example: ${0} auditor default view"
	exit
	fi

	USERNAME=${1}

	#!/bin/bash

	BIN_PATH="$HOME/.local/bin"


	help_msg () {
	echo "Usage: setkube -v [kubectl_version_number \| stable]"
	echo " setkube -d [kubectl_version_number]"
	echo ""
	echo " kubectl_version_number = 1.30.1, 1.32.0, etc."

	#!/bin/bash
	# usage: kubeadd new_kubeconfig_file

	cp ~/.kube/config ~/.kube/config.$(date +%F)
	KUBECONFIG=~/.kube/config:$1 kubectl config view --flatten > /tmp/config
	mv /tmp/config ~/.kube/config
	chmod 600 ~/.kube/config

	#!/bin/bash
	# run `kubeswitch` to list the contexts from .kube/config and set current context
	# run `source <(kubeswitch)` to use the selected context in active shell environment only
	# or add `alias kswitch='source <(kubeswitch)'` in ~/.bashrc

	unset KUBECONFIG
	select context in $(kubectl config get-contexts -o name); do
	kubectl config use-context $context &> /dev/null
	kubectl config view --minify --context $context --flatten > ${HOME}/.kube/$context.conf
	chmod 600 ${HOME}/.kube/$context.conf

	############ REPLACE app/models/enterprise_token.rb in the source code with this file! ################
	############ also be sure to RESTART OpenProject after replacing the file. ################
	############ it doesn't show that enterprise mode is enabled in the settings, but all ################
	############ enterprise mode features, such as KanBan boards, are enabled. ################
	#-- copyright
	# OpenProject is an open source project management software.
	# Copyright (C) 2012-2023 the OpenProject GmbH
	#
	# This program is free software; you can redistribute it and/or
	# modify it under the terms of the GNU General Public License version 3.